Control for whom? Before gdpr the general stance in the industry was we never delete user data, just mark a field saying its deleted in the db and that's that. It's been a total shift.
And it's not just that, I've seen first hand that even internal communication about customers are treated with more care as they can legally request all their data.
And it's not just that, I've seen first hand that even internal communication about customers are treated with more care as they can legally request all their data.